As of today, I am unable to publish my app to Cloud Run from Google AI Studio because it requires me to set a spend cap, but gives the error: “Only project owners, editors, or admins can set spend caps. Contact your project owner or select a different project to continue.” I avoid excessively permissive roles like Owner and Editor in my projects. Does anyone know the specific IAM role or permission required to set this spend cap so I can proceed? (If I attempt to publish the app without setting the cap, this error appears: “You must set a spend cap before publishing.“)
How are you, J.R-W? Everything alright? I hope so.
Is this managed at the project level or the billing account level? This distinction alters the minimum permission required.
The most likely and specific permission needed is billing.resourcebudgets.write on the project. For project spend caps, Cloud Billing documentation states that creating/managing budgets at the project level requires resourcemanager.projects.get, billing.resourcebudgets.read, and billing.resourcebudgets.write; billing.resourceCosts.get is optional and only necessary for viewing costs/graphs.
Importantly, accounts with project editor, owner, or admin roles can define the spend cap per project on the Spend page.
Therefore, to adhere to the principle of least privilege, the optimal solution is:
-
to create a custom role within the project with the following permissions:
resourcemanager.projects.getbilling.resourcebudgets.readbilling.resourcebudgets.writebilling.resourceCosts.get(optional)
If you are attempting to set a budget at the billing account level rather than a spend cap per project, the leanest pre-defined role is Billing Account Costs Manager (roles/billing.costsManager), which is designed for managing billing account budgets and includes permissions such as billing.budgets.create.
1 Like
Thank you so much for your generous help! I set up the custom role and everything works now!
I flagged to the team that we should add an info icon with the specific IAM permissions needed here, so will close the loop once that is done.